diff options
| author | Arne Schwabe | 2023-11-28 11:43:59 +0100 |
|---|---|---|
| committer | Gert Doering | 2023-12-02 16:33:25 +0100 |
| commit | 59551b93cdb55397d63b2fe58ad99612821c0faf (patch) | |
| tree | 9e7e0785e9d2c9128b201ca7d96985db39e59c77 | |
| parent | 6158228f16836f56a564d4533e7b513dc6170854 (diff) | |
| download | openvpn-59551b93cdb55397d63b2fe58ad99612821c0faf.zip openvpn-59551b93cdb55397d63b2fe58ad99612821c0faf.tar.gz | |
Fix check_session_buf_not_used using wrong index
The inner loop used i instead of j when iterating through the buffers.
Since i is always between 0 and 2 and ks->send_reliable->size is
(when it is defined) always 6 (TLS_RELIABLE_N_SEND_BUFFERS) this does not
cause an index of out bounds. So while the check was not doing anything
really useful with i instead of j, at least it was not crashing or
anything similar.
Noticed-By: Jon Williams (braindead-bf) on Github issue #449
Change-Id: Ia3d5b4946138df322ebcd9e9e77d04328dacbc5d
Signed-off-by: Arne Schwabe <arne@rfc2549.org>
Acked-by: Frank Lichtenheld <frank@lichtenheld.com>
Message-Id: <20231128104359.62967-1-frank@lichtenheld.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg27576.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
| -rw-r--r-- | src/openvpn/ssl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 400230c..b5d24b5 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -3207,7 +3207,7 @@ check_session_buf_not_used(struct buffer *to_link, struct tls_session *session) for (int j = 0; j < ks->send_reliable->size; j++) { - if (ks->send_reliable->array[i].buf.data == dataptr) + if (ks->send_reliable->array[j].buf.data == dataptr) { msg(M_INFO, "Warning buffer of freed TLS session is still in" " use (session->key[%d].send_reliable->array[%d])", |